Medium severity · published Jan 6, 2026
CVE-2025-9294
Quiz And Survey Master <= 10.3.1 - Missing Authorization to Authenticated (Subscriber+) Quiz Results Deletion
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the qsm_dashboard_delete_result function in all versions up to, and including, 10.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete quiz results.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QA
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker · expresstech
through 10.3.1 · source: vendor
QA
Quiz And Survey Master · Expresstech
before 10.3.2 · source: NVD
Affected product
QA
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
expresstech
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-9294
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-9294
Product
https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/admin/options-page-questions-tab.php#L1116
research.cleantalk.org
https://research.cleantalk.org/cve-2025-9294/
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/55895508-d0ef-4855-8d15-b8a45ba0dcb2?source=cve
More from Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
6.5
CVE-2026-2412
Quiz and Survey Master (QSM) <= 10.3.5 - Authenticated (Contributor+) SQL Injection via 'merged_question' Parameter
6.5
CVE-2025-9318
Quiz and Survey Master (QSM) <= 10.3.1 - Authenticated (Subscriber+) SQL Injection via `is_linking` Query Parameter
6.5
CVE-2025-9637
Quiz and Survey Master (QSM) <= 10.3.1 - Missing Authorization to Unpublished, Private And Password-Protected Quiz Information Disclosure And Image Response Uploads
5.3
CVE-2026-5797
Quiz and Survey Master (QSM) <= 11.1.0 - Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields
4.9
CVE-2026-6448
Quiz and Survey Master (QSM) <= 11.1.2 - Authenticated (Admin+) SQL Injection via 'order' and 'limit' Parameters